A critical SQL injection vulnerability in WWBN AVideo allows unauthenticated remote attackers to extract sensitive database information, including user credentials.

The application fails to properly sanitize input in the RTMP on_publish callback located at plugin/Live/on_publish.php. An unauthenticated attacker can supply a malicious stream key via the POST parameter to perform time-based blind SQL injection.

This vulnerability poses a severe risk to data confidentiality, as it enables unauthorized extraction of the entire database, including password hashes and user email addresses. Given the CVSS score of 7.5, the potential for mass data exfiltration necessitates immediate attention to prevent significant reputational damage and regulatory non-compliance.

Immediate Action: Apply the patch provided in commit af59eade82de645b20183cc3d74467a7eac76549 immediately. If patching is not feasible, restrict access to the affected RTMP callback endpoint via network-level controls.

Proactive Monitoring: Review web server and application logs for anomalous POST requests to the /plugin/Live/on_publish.php endpoint, particularly those containing SQL syntax characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting POST parameters.

Public Exploit Available: Unknown.

The vulnerability represents a significant risk to the integrity and confidentiality of the AVideo platform. Administrators must prioritize the application of the upstream fix to remediate the underlying SQL injection flaw and prevent potential data exfiltration.